API Docs

Getting started

1. Log in and accept the legal notice on the website once.
2. Go to My page > API keys and create your key (one per account). The full key is shown only once, so store it safely.
3. Send the key in the Authorization header of every request.

Authentication

Send your key as a Bearer token. Requests without a valid key return 401 invalid_api_key.

Authorization: Bearer fxa_xxxxxxxxxxxxxxxx

Start an analysis

POST/api/v1/scans

Submit up to 20 URLs, domains or IPs. The response returns a result ID right away; analysis runs in the background.

curl -X POST https://fixasap.net/api/v1/scans \
  -H "Authorization: Bearer $FIXASAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"targets": ["example.com", "https://another.com"]}'

HTTP/1.1 202 Accepted

{"job_id": "1c6a4c2e-8f0b-4c4f-9b8e-2f3a6d1e9b10", "status": "queued", "count": 2}

Get results

GET/api/v1/scans/{job_id}

Poll with the result ID until status is done. Results are kept for 24 hours.

curl https://fixasap.net/api/v1/scans/1c6a4c2e-8f0b-4c4f-9b8e-2f3a6d1e9b10 \
  -H "Authorization: Bearer $FIXASAP_API_KEY"

{
  "job_id": "1c6a4c2e-8f0b-4c4f-9b8e-2f3a6d1e9b10",
  "status": "done", "count": 2, "done": 2, "percent": 100,
  "targets": [
    {
      "target": "example.com", "status": "done",
      "result": {
        "final_url": "https://example.com/", "http_version": "HTTP/2", "edge_detected": true,
        "layers": {
          "edge":      [{"name": "Cloudflare", "confidence": 100, "determined": true}],
          "server":    [{"name": "nginx", "version": "1.25.3", "confidence": 80, "determined": false}],
          "runtime":   [{"name": "PHP", "confidence": 56, "determined": false}],
          "framework": [],
          "app":       [{"name": "WordPress", "confidence": 100, "determined": true}]
        }
      }
    },
    {"target": "another.com", "status": "failed", "error": "unreachable"}
  ]
}

Response fields

Limits

• Up to 20 targets at a time
• Up to 200 targets per hour for each account
• Up to 120 requests per minute per IP
• One API key per account

Errors

Errors return JSON like {"error": "code"}.